pam_pkcs11
0.6.8
|
00001 /* ***** BEGIN LICENSE BLOCK ***** 00002 * Version: MPL 1.1/GPL 2.0/LGPL 2.1 00003 * 00004 * The contents of this file are subject to the Mozilla Public License Version 00005 * 1.1 (the "License"); you may not use this file except in compliance with 00006 * the License. You may obtain a copy of the License at 00007 * http://www.mozilla.org/MPL/ 00008 * 00009 * Software distributed under the License is distributed on an "AS IS" basis, 00010 * WITHOUT WARRANTY OF ANY KIND, either express or implied. See the License 00011 * for the specific language governing rights and limitations under the 00012 * License. 00013 * 00014 * The Original Code is the Netscape security libraries. 00015 * 00016 * The Initial Developer of the Original Code is 00017 * Netscape Communications Corporation. 00018 * Portions created by the Initial Developer are Copyright (C) 1994-2000 00019 * the Initial Developer. All Rights Reserved. 00020 * 00021 * Contributor(s): 00022 * 00023 * Alternatively, the contents of this file may be used under the terms of 00024 * either the GNU General Public License Version 2 or later (the "GPL"), or 00025 * the GNU Lesser General Public License Version 2.1 or later (the "LGPL"), 00026 * in which case the provisions of the GPL or the LGPL are applicable instead 00027 * of those above. If you wish to allow use of your version of this file only 00028 * under the terms of either the GPL or the LGPL, and not to allow others to 00029 * use your version of this file under the terms of the MPL, indicate your 00030 * decision by deleting the provisions above and replace them with the notice 00031 * and other provisions required by the GPL or the LGPL. If you do not delete 00032 * the provisions above, a recipient may use your version of this file under 00033 * the terms of any one of the MPL, the GPL or the LGPL. 00034 * 00035 * ***** END LICENSE BLOCK ***** */ 00036 #ifndef _SEC_UTIL_H_ 00037 #define _SEC_UTIL_H_ 00038 00039 #include "seccomon.h" 00040 #include "secitem.h" 00041 #include "prerror.h" 00042 #include "base64.h" 00043 #include "key.h" 00044 #include "secpkcs7.h" 00045 #include "secasn1.h" 00046 #include "secder.h" 00047 #include <stdio.h> 00048 00049 #define SEC_CT_PRIVATE_KEY "private-key" 00050 #define SEC_CT_PUBLIC_KEY "public-key" 00051 #define SEC_CT_CERTIFICATE "certificate" 00052 #define SEC_CT_CERTIFICATE_REQUEST "certificate-request" 00053 #define SEC_CT_PKCS7 "pkcs7" 00054 #define SEC_CT_CRL "crl" 00055 00056 #define NS_CERTREQ_HEADER "-----BEGIN NEW CERTIFICATE REQUEST-----" 00057 #define NS_CERTREQ_TRAILER "-----END NEW CERTIFICATE REQUEST-----" 00058 00059 #define NS_CERT_HEADER "-----BEGIN CERTIFICATE-----" 00060 #define NS_CERT_TRAILER "-----END CERTIFICATE-----" 00061 00062 #define NS_CRL_HEADER "-----BEGIN CRL-----" 00063 #define NS_CRL_TRAILER "-----END CRL-----" 00064 00065 /* From libsec/pcertdb.c --- it's not declared in sec.h */ 00066 extern SECStatus SEC_AddPermCertificate(CERTCertDBHandle *handle, 00067 SECItem *derCert, char *nickname, CERTCertTrust *trust); 00068 00069 00070 #ifdef SECUTIL_NEW 00071 typedef int (*SECU_PPFunc)(PRFileDesc *out, SECItem *item, 00072 char *msg, int level); 00073 #else 00074 typedef int (*SECU_PPFunc)(FILE *out, SECItem *item, char *msg, int level); 00075 #endif 00076 00077 typedef struct { 00078 enum { 00079 PW_NONE = 0, 00080 PW_FROMFILE = 1, 00081 PW_PLAINTEXT = 2, 00082 PW_EXTERNAL = 3 00083 } source; 00084 char *data; 00085 } secuPWData; 00086 00087 /* 00088 ** Change a password on a token, or initialize a token with a password 00089 ** if it does not already have one. 00090 ** Use passwd to send the password in plaintext, pwFile to specify a 00091 ** file containing the password, or NULL for both to prompt the user. 00092 */ 00093 SECStatus SECU_ChangePW(PK11SlotInfo *slot, char *passwd, char *pwFile); 00094 00095 /* These were stolen from the old sec.h... */ 00096 /* 00097 ** Check a password for legitimacy. Passwords must be at least 8 00098 ** characters long and contain one non-alphabetic. Return DSTrue if the 00099 ** password is ok, DSFalse otherwise. 00100 */ 00101 extern PRBool SEC_CheckPassword(char *password); 00102 00103 /* 00104 ** Blind check of a password. Complement to SEC_CheckPassword which 00105 ** ignores length and content type, just retuning DSTrue is the password 00106 ** exists, DSFalse if NULL 00107 */ 00108 extern PRBool SEC_BlindCheckPassword(char *password); 00109 00110 /* 00111 ** Get a password. 00112 ** First prompt with "msg" on "out", then read the password from "in". 00113 ** The password is then checked using "chkpw". 00114 */ 00115 extern char *SEC_GetPassword(FILE *in, FILE *out, char *msg, 00116 PRBool (*chkpw)(char *)); 00117 00118 char *SECU_FilePasswd(PK11SlotInfo *slot, PRBool retry, void *arg); 00119 00120 char *SECU_GetPasswordString(void *arg, char *prompt); 00121 00122 /* 00123 ** Write a dongle password. 00124 ** Uses MD5 to hash constant system data (hostname, etc.), and then 00125 ** creates RC4 key to encrypt a password "pw" into a file "fd". 00126 */ 00127 extern SECStatus SEC_WriteDongleFile(int fd, char *pw); 00128 00129 /* 00130 ** Get a dongle password. 00131 ** Uses MD5 to hash constant system data (hostname, etc.), and then 00132 ** creates RC4 key to decrypt and return a password from file "fd". 00133 */ 00134 extern char *SEC_ReadDongleFile(int fd); 00135 00136 00137 /* End stolen headers */ 00138 00139 /* Just sticks the two strings together with a / if needed */ 00140 char *SECU_AppendFilenameToDir(char *dir, char *filename); 00141 00142 /* Returns result of getenv("SSL_DIR") or NULL */ 00143 extern char *SECU_DefaultSSLDir(void); 00144 00145 /* 00146 ** Should be called once during initialization to set the default 00147 ** directory for looking for cert.db, key.db, and cert-nameidx.db files 00148 ** Removes trailing '/' in 'base' 00149 ** If 'base' is NULL, defaults to set to .netscape in home directory. 00150 */ 00151 extern char *SECU_ConfigDirectory(const char* base); 00152 00153 /* 00154 ** Basic callback function for SSL_GetClientAuthDataHook 00155 */ 00156 extern int 00157 SECU_GetClientAuthData(void *arg, PRFileDesc *fd, 00158 struct CERTDistNamesStr *caNames, 00159 struct CERTCertificateStr **pRetCert, 00160 struct SECKEYPrivateKeyStr **pRetKey); 00161 00162 /* print out an error message */ 00163 extern void SECU_PrintError(char *progName, char *msg, ...); 00164 00165 /* print out a system error message */ 00166 extern void SECU_PrintSystemError(char *progName, char *msg, ...); 00167 00168 /* Return informative error string */ 00169 extern const char * SECU_Strerror(PRErrorCode errNum); 00170 00171 /* print information about cert verification failure */ 00172 extern void 00173 SECU_printCertProblems(FILE *outfile, CERTCertDBHandle *handle, 00174 CERTCertificate *cert, PRBool checksig, 00175 SECCertificateUsage certUsage, void *pinArg, PRBool verbose); 00176 00177 /* Read the contents of a file into a SECItem */ 00178 extern SECStatus SECU_FileToItem(SECItem *dst, PRFileDesc *src); 00179 extern SECStatus SECU_TextFileToItem(SECItem *dst, PRFileDesc *src); 00180 00181 /* Read in a DER from a file, may be ascii */ 00182 extern SECStatus 00183 SECU_ReadDERFromFile(SECItem *der, PRFileDesc *inFile, PRBool ascii); 00184 00185 /* Indent based on "level" */ 00186 extern void SECU_Indent(FILE *out, int level); 00187 00188 /* Print integer value and hex */ 00189 extern void SECU_PrintInteger(FILE *out, SECItem *i, char *m, int level); 00190 00191 /* Print ObjectIdentifier symbolically */ 00192 extern SECOidTag SECU_PrintObjectID(FILE *out, SECItem *oid, char *m, int level); 00193 00194 /* Print AlgorithmIdentifier symbolically */ 00195 extern void SECU_PrintAlgorithmID(FILE *out, SECAlgorithmID *a, char *m, 00196 int level); 00197 00198 /* Print SECItem as hex */ 00199 extern void SECU_PrintAsHex(FILE *out, SECItem *i, const char *m, int level); 00200 00201 /* dump a buffer in hex and ASCII */ 00202 extern void SECU_PrintBuf(FILE *out, const char *msg, const void *vp, int len); 00203 00204 /* 00205 * Format and print the UTC Time "t". If the tag message "m" is not NULL, 00206 * do indent formatting based on "level" and add a newline afterward; 00207 * otherwise just print the formatted time string only. 00208 */ 00209 extern void SECU_PrintUTCTime(FILE *out, SECItem *t, char *m, int level); 00210 00211 /* 00212 * Format and print the Generalized Time "t". If the tag message "m" 00213 * is not NULL, * do indent formatting based on "level" and add a newline 00214 * afterward; otherwise just print the formatted time string only. 00215 */ 00216 extern void SECU_PrintGeneralizedTime(FILE *out, SECItem *t, char *m, 00217 int level); 00218 00219 /* 00220 * Format and print the UTC or Generalized Time "t". If the tag message 00221 * "m" is not NULL, do indent formatting based on "level" and add a newline 00222 * afterward; otherwise just print the formatted time string only. 00223 */ 00224 extern void SECU_PrintTimeChoice(FILE *out, SECItem *t, char *m, int level); 00225 00226 /* callback for listing certs through pkcs11 */ 00227 extern SECStatus SECU_PrintCertNickname(CERTCertListNode* cert, void *data); 00228 00229 /* Dump all certificate nicknames in a database */ 00230 extern SECStatus 00231 SECU_PrintCertificateNames(CERTCertDBHandle *handle, PRFileDesc* out, 00232 PRBool sortByName, PRBool sortByTrust); 00233 00234 /* See if nickname already in database. Return 1 true, 0 false, -1 error */ 00235 int SECU_CheckCertNameExists(CERTCertDBHandle *handle, char *nickname); 00236 00237 /* Dump contents of cert req */ 00238 extern int SECU_PrintCertificateRequest(FILE *out, SECItem *der, char *m, 00239 int level); 00240 00241 /* Dump contents of certificate */ 00242 extern int SECU_PrintCertificate(FILE *out, SECItem *der, char *m, int level); 00243 00244 /* print trust flags on a cert */ 00245 extern void SECU_PrintTrustFlags(FILE *out, CERTCertTrust *trust, char *m, int level); 00246 00247 /* Dump contents of public key */ 00248 extern int SECU_PrintPublicKey(FILE *out, SECItem *der, char *m, int level); 00249 00250 #ifdef HAVE_EPV_TEMPLATE 00251 /* Dump contents of private key */ 00252 extern int SECU_PrintPrivateKey(FILE *out, SECItem *der, char *m, int level); 00253 #endif 00254 00255 /* Print the MD5 and SHA1 fingerprints of a cert */ 00256 extern int SECU_PrintFingerprints(FILE *out, SECItem *derCert, char *m, 00257 int level); 00258 00259 /* Pretty-print any PKCS7 thing */ 00260 extern int SECU_PrintPKCS7ContentInfo(FILE *out, SECItem *der, char *m, 00261 int level); 00262 00263 /* Init PKCS11 stuff */ 00264 extern SECStatus SECU_PKCS11Init(PRBool readOnly); 00265 00266 /* Dump contents of signed data */ 00267 extern int SECU_PrintSignedData(FILE *out, SECItem *der, char *m, int level, 00268 SECU_PPFunc inner); 00269 00270 extern int SECU_PrintCrl(FILE *out, SECItem *der, char *m, int level); 00271 00272 extern void 00273 SECU_PrintCRLInfo(FILE *out, CERTCrl *crl, char *m, int level); 00274 00275 extern void SECU_PrintString(FILE *out, SECItem *si, char *m, int level); 00276 extern void SECU_PrintAny(FILE *out, SECItem *i, char *m, int level); 00277 00278 extern void SECU_PrintPolicy(FILE *out, SECItem *value, char *msg, int level); 00279 extern void SECU_PrintPrivKeyUsagePeriodExtension(FILE *out, SECItem *value, 00280 char *msg, int level); 00281 00282 extern void SECU_PrintExtensions(FILE *out, CERTCertExtension **extensions, 00283 char *msg, int level); 00284 00285 extern void SECU_PrintName(FILE *out, CERTName *name, char *msg, int level); 00286 00287 #ifdef SECU_GetPassword 00288 /* Convert a High public Key to a Low public Key */ 00289 extern SECKEYLowPublicKey *SECU_ConvHighToLow(SECKEYPublicKey *pubHighKey); 00290 #endif 00291 00292 extern SECItem *SECU_GetPBEPassword(void *arg); 00293 00294 extern char *SECU_GetModulePassword(PK11SlotInfo *slot, PRBool retry, void *arg); 00295 00296 extern SECStatus DER_PrettyPrint(FILE *out, SECItem *it, PRBool raw); 00297 extern void SEC_Init(void); 00298 00299 extern char *SECU_SECModDBName(void); 00300 00301 extern void SECU_PrintPRandOSError(char *progName); 00302 00303 extern SECStatus SECU_RegisterDynamicOids(void); 00304 00305 /* Identifies hash algorithm tag by its string representation. */ 00306 extern SECOidTag SECU_StringToSignatureAlgTag(const char *alg); 00307 00308 /* Store CRL in output file or pk11 db. Also 00309 * encodes with base64 and exports to file if ascii flag is set 00310 * and file is not NULL. */ 00311 extern SECStatus SECU_StoreCRL(PK11SlotInfo *slot, SECItem *derCrl, 00312 PRFileDesc *outFile, int ascii, char *url); 00313 00314 00315 /* 00316 ** DER sign a single block of data using private key encryption and the 00317 ** MD5 hashing algorithm. This routine first computes a digital signature 00318 ** using SEC_SignData, then wraps it with an CERTSignedData and then der 00319 ** encodes the result. 00320 ** "arena" is the memory arena to use to allocate data from 00321 ** "sd" returned CERTSignedData 00322 ** "result" the final der encoded data (memory is allocated) 00323 ** "buf" the input data to sign 00324 ** "len" the amount of data to sign 00325 ** "pk" the private key to encrypt with 00326 */ 00327 extern SECStatus SECU_DerSignDataCRL(PRArenaPool *arena, CERTSignedData *sd, 00328 unsigned char *buf, int len, 00329 SECKEYPrivateKey *pk, SECOidTag algID); 00330 00331 typedef enum { 00332 noKeyFound = 1, 00333 noSignatureMatch = 2, 00334 failToEncode = 3, 00335 failToSign = 4, 00336 noMem = 5 00337 } SignAndEncodeFuncExitStat; 00338 00339 extern SECStatus 00340 SECU_SignAndEncodeCRL(CERTCertificate *issuer, CERTSignedCrl *signCrl, 00341 SECOidTag hashAlgTag, SignAndEncodeFuncExitStat *resCode); 00342 00343 extern SECStatus 00344 SECU_CopyCRL(PRArenaPool *destArena, CERTCrl *destCrl, CERTCrl *srcCrl); 00345 00346 /* 00347 ** Finds the crl Authority Key Id extension. Returns NULL if no such extension 00348 ** was found. 00349 */ 00350 CERTAuthKeyID * 00351 SECU_FindCRLAuthKeyIDExten (PRArenaPool *arena, CERTSignedCrl *crl); 00352 00353 /* 00354 * Find the issuer of a crl. Cert usage should be checked before signing a crl. 00355 */ 00356 CERTCertificate * 00357 SECU_FindCrlIssuer(CERTCertDBHandle *dbHandle, SECItem* subject, 00358 CERTAuthKeyID* id, PRTime validTime); 00359 00360 00361 /* call back function used in encoding of an extension. Called from 00362 * SECU_EncodeAndAddExtensionValue */ 00363 typedef SECStatus (* EXTEN_EXT_VALUE_ENCODER) (PRArenaPool *extHandleArena, 00364 void *value, SECItem *encodedValue); 00365 00366 /* Encodes and adds extensions to the CRL or CRL entries. */ 00367 SECStatus 00368 SECU_EncodeAndAddExtensionValue(PRArenaPool *arena, void *extHandle, 00369 void *value, PRBool criticality, int extenType, 00370 EXTEN_EXT_VALUE_ENCODER EncodeValueFn); 00371 00372 00373 /* 00374 * 00375 * Utilities for parsing security tools command lines 00376 * 00377 */ 00378 00379 /* A single command flag */ 00380 typedef struct { 00381 char flag; 00382 PRBool needsArg; 00383 char *arg; 00384 PRBool activated; 00385 } secuCommandFlag; 00386 00387 /* A full array of command/option flags */ 00388 typedef struct 00389 { 00390 int numCommands; 00391 int numOptions; 00392 00393 secuCommandFlag *commands; 00394 secuCommandFlag *options; 00395 } secuCommand; 00396 00397 /* fill the "arg" and "activated" fields for each flag */ 00398 SECStatus 00399 SECU_ParseCommandLine(int argc, char **argv, char *progName, secuCommand *cmd); 00400 char * 00401 SECU_GetOptionArg(secuCommand *cmd, int optionNum); 00402 00403 /* 00404 * 00405 * Error messaging 00406 * 00407 */ 00408 00409 /* Return informative error string */ 00410 char *SECU_ErrorString(int16 err); 00411 00412 /* Return informative error string. Does not call XP_GetString */ 00413 char *SECU_ErrorStringRaw(int16 err); 00414 00415 void printflags(char *trusts, unsigned int flags); 00416 00417 #ifndef XP_UNIX 00418 extern int ffs(unsigned int i); 00419 #endif 00420 00421 #include "secerr.h" 00422 #include "sslerr.h" 00423 00424 #endif /* _SEC_UTIL_H_ */